Go/goshs.de/goshs

goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

Modified: 6/25/2026

goshs has ACL Bypass & Path Traversal

Modified: 8/18/2026

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

Modified: 8/18/2026

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)

Modified: 8/18/2026

goshs has a Path Traversal issue

Modified: 8/18/2026

goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request in goshs.de/goshs

Modified: 6/25/2026

goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags in goshs.de/goshs

Modified: 7/7/2026

goshs: Share-link ?token=… redemption races past download limit in goshs.de/goshs

Modified: 7/7/2026

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) in goshs.de/goshs

Modified: 8/18/2026

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

Modified: 8/18/2026

goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

Modified: 8/18/2026

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

Modified: 8/18/2026

goshs has a Path Traversal issue in github.com/patrickhener/goshs

Modified: 8/18/2026